Security & data handling
Written for the person who has to approve us. Every statement below describes what the product does today. Where something is not yet independently certified, we say so rather than implying it is.
What the service is, and its hard boundary
AlphaSortino is an analysis desk. It screens assets, builds candidate portfolios, tests them out of sample, and writes up every decision with the figures behind it. A person decides what to do with that analysis.
- It never places orders, routes trades, holds client money or takes custody.
- It is not a regulated investment adviser, broker or fiduciary, and gives no personal advice.
- Outputs are dated analyses, not live trading signals.
- The no-execution boundary is enforced in code and restated on every export.
What data we hold, and where it lives
| Data | Why we hold it | Location |
|---|---|---|
| Account and seat records | Access control and contract administration | EU (Ireland) managed Postgres |
| Mandate and run inputs | To reproduce and audit a run | EU (Ireland) managed Postgres |
| Holdings, weights and amounts | Portfolio construction and reporting | EU, additionally encrypted at field level |
| Uploaded documents | Evidence for the analysis you asked for | EU private object storage, per-customer isolated |
| Chat and report text | Continuity and auditability of the analysis | EU (Ireland) managed Postgres |
| Market and filing data | Input evidence, fetched from official sources | Cached in the same region |
Data leaves that region only when a model call is made to a processor listed below, and only with the content that call needs. Outbound text passes a redaction step that removes personal identifiers before it is sent.
Encryption
- In transit: TLS 1.2+ on every connection, including internal service calls.
- At rest: AES-256 on the database, on backups and on object storage.
- Additionally encrypted at field level, with a separate key: questionnaire answers, holdings and amounts, broker identifiers, uploaded statements, and chat text flagged as containing personal data.
- Deliberately not field-encrypted: derived risk scores and agent reasoning traces, because our own integrity checks and a human reviewer must be able to audit them.
Who can see it
Access is decided on the server from your seat and organisation, never from anything the browser sends. Each customer's rows are isolated by database policy, so a query cannot reach another customer's data even if the application is wrong. Staff access to production data requires a named reason, is limited to the smallest scope that answers it, and is logged.
What the models may and may not do
| Capability | Status |
|---|---|
| Read the evidence gathered for your run | Allowed |
| Read documents you uploaded to your own workspace | Allowed, audited |
| Introduce a fact not present in the structured evidence | Blocked by the fact-check gate |
| Fetch from a source outside the approved list | Blocked at the network guard |
| Reach another customer's data | Not possible — isolation is enforced in the database |
| Place an order or move money | Not implemented anywhere in the system |
| Train on your data by default | No. Off unless your contract opts in |
Retention and deletion
- Runs, reports and chat are kept for the life of the contract so results stay reproducible.
- Uploaded documents can be deleted by you at any time from settings, individually or all at once.
- On termination, customer data is deleted within 30 days; backups age out within a further 30.
- An erasure request for a named individual is completed within 30 days.
- Audit records of who accessed what are kept for 12 months and are not deletable by users.
Lawful bases (GDPR)
| Processing | Basis |
|---|---|
| Providing the service under contract | Art. 6(1)(b) contract |
| Security, audit logging and abuse prevention | Art. 6(1)(f) legitimate interests |
| Statutory record keeping | Art. 6(1)(c) legal obligation |
| Improving models from your data | Art. 6(1)(a) consent — off unless opted in |
We act as processor for customer data, and controller for account and billing records. A DPA with EU standard contractual clauses is available and signed before any pilot begins.
Subprocessors
| Subprocessor | Purpose | Region |
|---|---|---|
| Managed application and database hosting | Running the service and storing customer data | EU (Ireland) |
| Model providers reached through our gateway | Language-model inference for analysis text | EU/US, per-call, no training on our traffic |
| Market and filing data providers | Prices, fundamentals and official disclosures | US/EU |
| Transactional email | Account and access messages | EU |
Customers are notified before a new subprocessor is added, with the right to object.
How we keep the output honest
- Every figure in a report must trace to a computed value, or it is marked unverified in the report itself.
- Every external fetch is checked against an approved-source list, and each fact carries its source and date.
- When evidence is thin, confidence is capped and the report says what is missing.
- A failed check is never silently downgraded to a pass; a degraded run is labelled as degraded.
- Each run has an input and output fingerprint so the same inputs can be shown to reproduce it.
Availability, backups and incidents
- Daily encrypted backups with point-in-time recovery; restores are tested.
- We are not SOC 2 or ISO 27001 certified today, and we will not claim otherwise during procurement.
- Security incidents affecting customer data are reported to the customer contact within 72 hours, with what happened, what was affected, and what we changed.
Contact
Security and data-protection questions go to your named contact in the pilot agreement, or through account settings once signed in. This page is printable as a one-page summary for a procurement file.